{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3fda2df0-916a-5808-a744-5e27ea71857e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6", "version": "6.1.4-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:ba6976d2-b835-5e02-8820-ad16cf254b5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:d3b76b52-3adc-5cd3-8464-fa4bfb69cd38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:001020a3-3261-577e-bc59-2a9840aaff39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:e57216ba-67d8-5933-89b7-092bd0c4d9ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:27d800f8-a50d-5171-bbb5-c2fe48927677", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:1765a49b-1537-51ce-891f-6c84be0712fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:11c2c602-5379-5415-a841-3b3d0bc9b711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:55526d31-c25d-5b28-a299-105cdcaeae45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:9cdb6119-0ed6-588c-b722-e376175edec3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:c3073d52-1e83-5a64-b4ee-dd3be61d2153", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:e2f8fdfc-3dde-51ef-abb7-d8eadaae1ca3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:498a3a98-b7bb-528e-af9b-04d72547f0e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:17d1823b-5bc0-5cb8-bb60-13457ea0c0e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:4e67b36f-4065-5e81-be09-565d282ae9b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:4fd5bbfb-7790-571c-9b0e-37347b33c563", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:b0eeffcc-b68f-5dd4-ae71-d8fbc1e13db0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:fe4189f2-b40d-5e3c-a706-deb471ab193a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-beans. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:a9f9584b-fb72-50ae-8288-64caea1ad90c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:79a69bd1-70ff-5b7e-a4bd-527fa5550a84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:388d75f5-8575-5140-a8d6-d22788914de0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:25b7d88a-2902-5c7c-8a07-d8193a14204c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.1.4-tuxcare.6 of org.springframework:spring-beans, and is fixed in 6.1.4-tuxcare.8." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:012029c1-73ab-5e59-80d9-8e2b76e43cfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.6" } ] }